82808cc026
[ Upstream commit 84a24bf8c52e66b7ac89ada5e3cfbe72d65c1896 ]
While this code is executed with the wait_lock held, a reader can
acquire the lock without holding wait_lock. The writer side loops
checking the value with the atomic_cond_read_acquire(), but only truly
acquires the lock when the compare-and-exchange is completed
successfully which isn’t ordered. This exposes the window between the
acquire and the cmpxchg to an A-B-A problem which allows reads
following the lock acquisition to observe values speculatively before
the write lock is truly acquired.
We've seen a problem in epoll where the reader does a xchg while
holding the read lock, but the writer can see a value change out from
under it.
Writer | Reader
--------------------------------------------------------------------------------
ep_scan_ready_list() |
|- write_lock_irq() |
|- queued_write_lock_slowpath() |
|- atomic_cond_read_acquire() |
| read_lock_irqsave(&ep->lock, flags);
--> (observes value before unlock) | chain_epi_lockless()
| | epi->next = xchg(&ep->ovflist, epi);
| | read_unlock_irqrestore(&ep->lock, flags);
| |
| atomic_cmpxchg_relaxed() |
|-- READ_ONCE(ep->ovflist); |
A core can order the read of the ovflist ahead of the
atomic_cmpxchg_relaxed(). Switching the cmpxchg to use acquire
semantics addresses this issue at which point the atomic_cond_read can
be switched to use relaxed semantics.
Fixes: b519b56e37 ("locking/qrwlock: Use atomic_cond_read_acquire() when spinning in qrwlock")
Signed-off-by: Ali Saidi <alisaidi@amazon.com>
[peterz: use try_cmpxchg()]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Steve Capper <steve.capper@arm.com>
Acked-by: Will Deacon <will@kernel.org>
Acked-by: Waiman Long <longman@redhat.com>
Tested-by: Steve Capper <steve.capper@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
85 lines
2.3 KiB
C
85 lines
2.3 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Queued read/write locks
|
|
*
|
|
* (C) Copyright 2013-2014 Hewlett-Packard Development Company, L.P.
|
|
*
|
|
* Authors: Waiman Long <waiman.long@hp.com>
|
|
*/
|
|
#include <linux/smp.h>
|
|
#include <linux/bug.h>
|
|
#include <linux/cpumask.h>
|
|
#include <linux/percpu.h>
|
|
#include <linux/hardirq.h>
|
|
#include <linux/spinlock.h>
|
|
#include <asm/qrwlock.h>
|
|
|
|
/**
|
|
* queued_read_lock_slowpath - acquire read lock of a queue rwlock
|
|
* @lock: Pointer to queue rwlock structure
|
|
*/
|
|
void queued_read_lock_slowpath(struct qrwlock *lock)
|
|
{
|
|
/*
|
|
* Readers come here when they cannot get the lock without waiting
|
|
*/
|
|
if (unlikely(in_interrupt())) {
|
|
/*
|
|
* Readers in interrupt context will get the lock immediately
|
|
* if the writer is just waiting (not holding the lock yet),
|
|
* so spin with ACQUIRE semantics until the lock is available
|
|
* without waiting in the queue.
|
|
*/
|
|
atomic_cond_read_acquire(&lock->cnts, !(VAL & _QW_LOCKED));
|
|
return;
|
|
}
|
|
atomic_sub(_QR_BIAS, &lock->cnts);
|
|
|
|
/*
|
|
* Put the reader into the wait queue
|
|
*/
|
|
arch_spin_lock(&lock->wait_lock);
|
|
atomic_add(_QR_BIAS, &lock->cnts);
|
|
|
|
/*
|
|
* The ACQUIRE semantics of the following spinning code ensure
|
|
* that accesses can't leak upwards out of our subsequent critical
|
|
* section in the case that the lock is currently held for write.
|
|
*/
|
|
atomic_cond_read_acquire(&lock->cnts, !(VAL & _QW_LOCKED));
|
|
|
|
/*
|
|
* Signal the next one in queue to become queue head
|
|
*/
|
|
arch_spin_unlock(&lock->wait_lock);
|
|
}
|
|
EXPORT_SYMBOL(queued_read_lock_slowpath);
|
|
|
|
/**
|
|
* queued_write_lock_slowpath - acquire write lock of a queue rwlock
|
|
* @lock : Pointer to queue rwlock structure
|
|
*/
|
|
void queued_write_lock_slowpath(struct qrwlock *lock)
|
|
{
|
|
int cnts;
|
|
|
|
/* Put the writer into the wait queue */
|
|
arch_spin_lock(&lock->wait_lock);
|
|
|
|
/* Try to acquire the lock directly if no reader is present */
|
|
if (!atomic_read(&lock->cnts) &&
|
|
(atomic_cmpxchg_acquire(&lock->cnts, 0, _QW_LOCKED) == 0))
|
|
goto unlock;
|
|
|
|
/* Set the waiting flag to notify readers that a writer is pending */
|
|
atomic_add(_QW_WAITING, &lock->cnts);
|
|
|
|
/* When no more readers or writers, set the locked flag */
|
|
do {
|
|
cnts = atomic_cond_read_relaxed(&lock->cnts, VAL == _QW_WAITING);
|
|
} while (!atomic_try_cmpxchg_acquire(&lock->cnts, &cnts, _QW_LOCKED));
|
|
unlock:
|
|
arch_spin_unlock(&lock->wait_lock);
|
|
}
|
|
EXPORT_SYMBOL(queued_write_lock_slowpath);
|